Executive brief
Google Chrome's StorageAccessAPI contained an information leak vulnerability that allowed attackers to access sensitive cross-origin data by crafting and hosting a malicious web page. A user visiting the attacker's page would inadvertently leak data from other websites they visit, potentially exposing sensitive account information or cookies. This vulnerability affects users on Windows, Mac, and Linux who use Chrome versions earlier than 152.0.7977.65.
Technical details
The vulnerability is a cross-origin information leak in Chrome's StorageAccessAPI component affecting Chrome versions prior to 152.0.7977.65. The root cause stems from improper enforcement of the same-origin policy when handling storage access requests, allowing a remote attacker to craft a malicious HTML page that can read data from other origins. The attack requires user interaction (visiting the attacker's web page) but operates over the network without authentication. An attacker can extract sensitive cross-origin data such as cookies, localStorage, or sessionStorage. The issue is patched in Chrome 152.0.7977.65 and later releases.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Chrome 152.0.7977.65 released with fix